Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(web): address wildcard host review

Browse Source
This commit is contained in:
Tianyi Cui
2026-08-13 16:37:49 +08:00
parent 2466a1d59c
commit 0a42836fbb
8 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/client/connection/src/api-request-trust.ts
View File

@@ -7,8 +7,8 @@
* nor Fetch-Metadata to reads (images and navigations — those
* headers go only to trustworthy destinations), so an unmarked request may
* still be a rebound browser read and Host is the one header rebinding cannot
* forge. Non-browser and remote clients pass the same fence via loopback, the
* CLI-derived LAN IP literals, or a declared `trustedHosts` authority.
* forge. Non-browser and remote clients pass the same fence via loopback,
* deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
* Network reachability and authentication stay out of scope: binding policy
* belongs to the webserver config, and this fence is not an auth layer.
*/